The strongest approach is layered, not AI-only. Use AI for anomaly detection and triage, then back it with identity verification, behavioural biometrics, MFA, CAPTCHA, and liveness checks where risk is higher. Identity orchestration helps apply those controls contextually, so legitimate users see less friction while suspicious sessions face more scrutiny. The goal is precision, not blanket challenge.
How layered fraud controls reduce friction without becoming blunt instruments
The practical answer is to separate detection from challenge. AI can score risk in real time, but the decision to step up should be driven by the specific signal, transaction context, and customer history rather than a flat rule applied to everyone. That is what keeps legitimate users moving while concentrating controls where fraud likelihood is actually elevated.
A useful way to think about the stack is progressive trust: low-risk activity passes with minimal interruption, medium-risk activity gets lightweight checks, and high-risk activity gets stronger verification. That sequencing matters because the same control can be useful or annoying depending on when it is invoked. For example, behavioural biometrics and anomaly scoring are most valuable when they quietly filter the baseline; MFA, CAPTCHA, and liveness checks should be reserved for the points where the risk justifies the extra effort.
Good programmes also avoid over-relying on any single signal. AI models can flag unusual device, velocity, or interaction patterns, but those signals are strongest when combined with identity proofing, session history, and transaction knowledge. For a broader control view, align the workflow with CIS Controls v8 for account management and audit logging, and with NIST Cybersecurity Framework 2.0 for detect, protect, respond, and recover coordination. When the process is tuned well, the customer sees one control path, not a pile of disconnected checks.
In practice, the friction reduction comes from orchestration, not from weakening defences. Identity orchestration lets you trigger stronger controls only when the risk score, channel sensitivity, or behavioural deviation crosses a threshold. That creates a more precise experience than permanent step-up prompts, which often train customers to distrust the process and abandon legitimate actions.
Where fraud stacks fail in practice
The common failure mode is treating AI as a replacement for control design. A model may identify suspicious behaviour, but if the organisation lacks reliable identity verification, session controls, and escalation paths, the result is either false confidence or a flood of manual reviews. The other mistake is hard-coding friction too early, which makes low-risk users pay the cost of high-risk cases.
Another weakness is poor signal quality. AI cannot compensate for weak telemetry, fragmented customer identity records, or inconsistent step-up rules across channels. If the same customer gets different treatment in mobile, web, and contact-centre flows, fraud teams lose consistency and customers experience arbitrary challenge. For AI-specific governance on how to avoid over-automation and over-trust, NIST AI Risk Management Framework provides the right lens for managing model behaviour, while OWASP Cheat Sheet Series is useful for implementation details around authentication and session handling.
Friction also rises when controls are deployed uniformly rather than contextually. If every transaction gets MFA or liveness checks, you create challenge fatigue, more abandonment, and weaker trust in the channel. The better pattern is to define the exact conditions that justify escalation, then make those conditions transparent to the fraud and customer-operations teams so they can tune thresholds together.
For teams looking for a control baseline around customer-facing fraud and step-up design, ISO/IEC 27001:2022 Information Security Management supports the governance side, while NIST Cybersecurity Framework 2.0 helps keep the operational loop closed between detection and response.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST AI RMF set the technical controls, while ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 5 — Account Management | Contextual step-up fraud controls depend on reliable account and session governance. |
| CIS Control 8 — Audit Log Management | AI fraud detection needs telemetry and audit trails to support triage and challenge decisions. | |
| Recommendation — Enforce account lifecycle and access hygiene before allowing high-risk customer actions. Centralise and retain logs so fraud signals can be investigated and tuned. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Fraud scoring relies on continuous monitoring of user and session behaviour. |
| PR.AA — Identity Management, Authentication, and Access Control | The answer depends on identity verification, MFA, and contextual access decisions. | |
| Recommendation — Monitor transactions and sessions continuously to trigger proportionate step-up controls. Apply contextual authentication and access controls based on observed risk. | ||
| NIST AI RMF | GOV — Govern | AI fraud controls need accountable governance over model use, thresholds, and escalation. |
| MAP — Map | Fraud detection requires understanding where AI is used and what risks it introduces. | |
| MEASURE — Measure | Precision, false positives, and user friction must be measured to tune the control stack. | |
| Recommendation — Define ownership, escalation criteria, and accountability for AI-driven fraud decisions. Map fraud-use cases, data inputs, and failure modes before operationalising the model. Measure model accuracy and customer-friction impact to keep step-up decisions proportionate. | ||
| ISO/IEC 42001:2023 | 6.1 — Actions to Address Risks and Opportunities | AI fraud controls require structured risk treatment and opportunity management. |
| 8.2 — AI System Operation | Operational controls must govern how the fraud model is used in live customer flows. | |
| Recommendation — Treat AI fraud scoring as a managed risk process with defined treatments and review. Operate AI fraud checks with defined thresholds, monitoring, and escalation paths. | ||
Practitioner Guidance
What to prioritise: Tune step-up controls around the highest-loss fraud paths first, not around every suspicious signal. That usually means protecting account recovery, new-device access, payment changes, and high-value transfers before adding more friction to routine login.
What to verify: Check that each challenge type is mapped to a specific risk trigger and that false positives are measurable. If you cannot explain why a customer was challenged, the workflow is too blunt to be trusted.
Decision rule: If AI confidence is high but customer impact is also high, use the AI result to route to a lower-friction verification step before escalating to stronger controls. If the fraud loss potential is high, err toward stronger verification even when the user journey becomes slightly longer.
Practitioner takeaway: The best fraud controls are adaptive, not maximalist, because precision reduces both fraud loss and customer abandonment.
Related resources from NHI Mgmt Group
- How should organisations use active liveness detection to reduce biometric fraud without adding too much user friction?
- How should banks and digital businesses reduce fraud without adding too much customer friction?
- How should organisations implement PSD2 controls without adding too much checkout friction?
- How should fintech teams embed fraud controls without creating too much customer friction?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
